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WHAT IS CLAIMED IS: 



1 . A method for recognizing and flagging a data item used by one or more 
application programs as falling within the scope of a rule but anomalous when compared with 
other data items falling within the scope of the rule, the method comprising: 

determining a collection to which the data item belongs as defined by the rule; 

calculating statistics for the other data items in the collection; 

identifying whether the data item is an anomalous data item based on the 
statistical calculations; and 

flagging the data item as an anomalous data item if the data item is identified as 
an anomalous data item. 

2. The method of claim 1 wherein calculating comprises calculating a mean data 
item size and standard deviation for the other data items in the collection. 

3. The method of claim 1 wherein calculating comprises calculating a mean 
interval between data items and standard deviation for the other data items in the collection. 

4. The method of claim 1 wherein calculating comprises calculating a mean data 
item arrival time and standard deviation for the other data items in the collection. 

5. The method of claim 1 wherein calculating comprises: 



calculating a presence or absence of keywords for the other data items in the 



collection; and 



identifying whether the data item is an anomalous data item based on the presence 



or absence of keywords. 



6. The method of claim 1 wherein calculating statistics for the other data items in 



the collection is performed in real time. 
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7. The method of claim 1 wherein the step of calculating statistics for the other 
data items in the collection is performed periodically, 

8. The method of claim 1 wherein identifying comprises determining whether the 
data item falls outside a number of standard deviations from the statistical calculations. 

9. The method of claim 8 comprising setting the number of standard deviations to 
a value set by a user. 

10. Computer readable media comprising program code, the program code 
instructing a programmable computer to execute a method for recognizing and flagging a data 
item used by one or more application programs as falling within the scope of a rule but 
anomalous when compared with other data items falling within the scope of the rule, the method 
comprising: 

determining a collection to which the data item belongs as defined the rule; 

calculating statistics for the other data items in the collection; 

identifying whether the data item is an anomalous data item based on the 
statistical calculations; and 

flagging the data item as an anomalous data item if the data item is identified as 
an anomalous data item. 

1 1 . The computer readable media of claim 1 0 comprising a method for 
recognizing and flagging a data item used by one or more application programs as falling within 
the scope of a rule but anomalous when compared with other data items falling within the scope 
of the rule wherein calculating comprises calculating a mean data item size and standard 
deviation for the other data item sin the collection. 
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12. The computer readable media of claim 10 comprising a method for 
recognizing and flagging a data item used by one or more application programs as falling within 
the scope of a rule but anomalous when compared with other data items falling within the scope 
of the rule wherein calculating comprises calculating a mean interval between data items and 
standard deviation for the other data items in the collection. 

1 3 . The computer readable media of claim 1 0 comprising a method for 
recognizing and flagging a data item used by one or more application programs as falling within 
the scope of a rule but anomalous when compared with other data items falling within the scope 
of the rule wherein calculating comprises calculating a mean data item arrival time and standard 
deviation for the other data items in the collection. 

1 4. The computer readable media of claim 1 0 comprising a method for 
recognizing and flagging a data item used by one or more application programs as falling within 
the scope of a rule but anomalous when compared with other data items falling within the scope 

of the rule wherein calculating comprises: 

calculating a presence or absence of keywords for other data items in the 

collection; and 

identifying whether the data item is an anomalous data item based on the presence 

or absence of keywords. 

15. The computer readable media of claim 10 comprising a method for 
recognizing and flagging a data item used by one or more application programs as falling within 
the scope of a rule but anomalous when compared with other data items falling within the scope 
of the rule wherein calculating statistics for other data items in the collection is performed in real 

time. 
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16. The computer readable media of claim 10 comprising a method for 
recognizing and flagging a data item used by one or more application programs as falling within 
the scope of a rule but anomalous when compared with other data items falling within the scope 
of the rule wherein calculating statistics for other data items in the collection is performed 
periodically. 

17. The computer readable media of claim 10 comprising a method for 
recognizing and flagging a data item used by one or more application programs as falling within 
the scope of a rule but anomalous when compared with other data items falling within the scope 
of the rule wherein identifying comprises determining whether the data item falls outside a 
number of standard deviations from the statistical calculations. 

18. The computer readable media of claim 1 7 comprising a method for 
recognizing and flagging a data item used by one or more application programs as falling within 
the scope of a rule but anomalous when compared with other data items falling within the scope 
of the rule comprising setting the number of standard deviations to a value set by a user. 
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